Gmail enters the "extend" phase of Embrace, Extend, Extinguish by creating new proprietary features for email then forcing non-gmail users the view the mail through a link with Google Login (and sometimes SMS confirmation!)
Worth remembering even for self-hosters:
Network effects increase the extent to which *other* people's choices affect us.
I wonder if the two implementations are interoperable? (I'll take a guess and say no!)
Yeah I'm not in favour of Proton Mail doing it either, although I don't know if they require a login and/or sms verification to view the mail.
Maybe best look at another provider or do what I do and self-host.
I've had this feature on Protonmail for months and it's just not that useful, nor is it evil
I think the bigger threat is how Gmail kinda-sorta blocks smaller email providers
And I would highly recommend Protonmail, btw
@paul The article didn't mention how this works with google's ad placement within gmail. Do you know? Or have google said? Scanning an email in order to place ads, a normal gmail function, doesn't seem very compatible with confidentiality. (I searched but only found other articles basically recapping the same info as the one you linked.)
@jannamark Apparently because of the upcoming GDPR Gmail no longer scans emails to help build advertising profiles
But I don't think this new feature would make a difference anyway as it sounds like Google always has the keys any confidential email sent.
It would stop any competitors from reading the email though..
@phryk oops, meant to stick this link on that toot!
I’ve been considering moving away from Gmail for a while now, but so much of my online identity is tied to that gmail account.
So many logins. So many rarely used services.
I don’t think I could get away with abandoning it entirely, but I could probably get another address set up with another service and start the migration? A domain I control, but hosted through a big service?
@ajroach42 If you're used to sysadmin tasks, setting up your own email server with postfix/dovecot and friends is pretty easy and once it's done, requires minimal maintenance. I've been running my own server for years.
If you don't have the time or desire, setting up a custom domain on Protonmail or Fastmail along with redirection for your old address should take no longer than an hour.
Then it's just a case of updating accounts to use the new address
@paul @bhtooefr @ajroach42 I'm lucky, my isp provides a static IP for £1 per month so self hosting from home is easy. In the past I have also hosted from home on a dynamic ip with no reverse DNS and only ever had deliverability problems to hotmail addresses occasionally. There aren’t actually many servers that will block you just for having dynamic IP
@bhtooefr @paul @ajroach42 no never. I make sure DKIM and SPF are good and deliverability is fine. The only issues have been Microsoft just dropping emails occasionally. There are loads of post on stack overflow and elsewhere where ppl suffer the same thing. Their servers say they have received the message and will deliver it, then it’s just dropped with the receiver never seeing the email.
@bhtooefr @paul @ajroach42 you have to find the well hidden MS tools to register ownership of your domain/IPs and that helps. Will send you a link once I’m near a computer. They also try to up sell you to a company called returnpath which will guarantee you always get delivered to Outlook/Hotmail for about $5000 dollars per year. It’s a total racket.
If you do the recommendations there and set everything else up to best practices you’ll be fine
Doesn't matter where you host it. Just start transitioning to it, and you can change hosts at your leisure.
My email was first hosted with Google Apps, then with Cotse, and now with Fastmail (which I love and recommend.)
@paul @tdemin Protonmail only needs a passphrase to access a message not login/sms. They give a place for you to give a hint. Otherwise it's up to you to provide the shared secret outside of the email.
I'd prefer encryption at the user level via pgp, but this at least gives me the option to force people to embrace it if they want to read my message. My track record for selling pgp use is pretty much nil.
On the other hand, it vastly increases social engineering risk.
Something like the signal protocol over email would be nice, but I think most ppl see email as being insecure forever sadly
@paul Let the unmitigated harassment with no paper trail BEGIN!
@paul Same is the case with ProtonMail's encrypted email that only works between users of the same email service, disregarding technologies like PGP which work irrespective of email providers.
Thunderbird's enigmail should be made easier to use. And a mobile version maybe. These should be recommended instead of ProtonMail.
@paul If I have to log into Google to view one of their screwball "self-destructing" emails I'm going to email the sender back and say "please send me a normal email". Proprietary extensions defeat the whole purpose of email, and the entire purpose of many emails is to be a semi-permanent record. Take that away and we may as well be communicating by smoke signals.
@paul looks like a solution in search of a problem... it's only going to be as secure as the end recipient's system (ignoring the blatant security hole of trusting Google to begin with), and while you may not be able to "forward, download or copy" the message I'd be incredibly surprised if they found a way to block screenshots...
@paul Could be. I saw an SMS passcode mention, but that appeared to be a feature the sender could choose to enable or not.
Even if this works without a login at the start, I don't trust Google to necessarily keep it that way, nor do I trust them not to continue with the Embrace, Extend, Extinguish pattern in some fashion. More importantly, another article pointed out there was no mention of encryption with this feature, either, so it sounds more like a gimmick than anything to me.
@tw yeah very likely. @unextro mentioned Microsoft have recently rolled out this feature for office365 so google are playing catch-up with them. Possible they just want to have the feature for that reason rather than as a true secure system.
It certainly sounds like something that bosses would like without thinking of the many ways it isn’t secure!
@paul Would like to point out that it's most likely in reaction to Micro$oft doing the same thing already... https://mastodon.social/@unextro/99864097819011196
@paul For all the talk about the new Microsoft it still look the same to me under the new coating.
Already in their usual game with PWAs... "PWAs installed via the store will ... have access to the full suite of WinRT APIs available to UWP apps. They can differentiate their experience on Windows 10 with enhancements like access to local calendar and contacts data (with permission) and more." (https://blogs.windows.com/msedgedev/2018/02/06/welcoming-progressive-web-apps-edge-windows-10)
@upshotknothole @mysizepurple It doesn't take much to keep spam at bay actually. Spamassassin and postgrey do a great job. Plus you can easily train Spamassassin to show it what is/isn't spam so it just gets better over time.
Plus there are other tweaks you can make to Postfix to be more restrictive over what it allows to connect and/or send to your server.
Since January this year I've had one spam email that didn't get caught before making it to inbox, so not too bad
@Angle @paul There are good reasons to not use GMail anyway. If anything this kind of behavior highlights the other ones. Having a few big providers (or one big provider) everyone uses just invites this kind of thing.
GMail's over-aggressive antispam policies that make it increasingly difficult for independent providers to host mailing lists and drive people into the TRULY AWFUL GOOGLE GROUPS is another example.